Privacy Policy

8.1 Scope

This Privacy Policy explains how Dropo collects, uses, shares, protects and retains personal information in connection with its websites, applications, PWAs, logistics services, Access Points and related operations.

8.2 Categories of Information

Dropo may collect:

Account information

• name
• email
• phone
• authentication information
• customer identifiers
• organization affiliation

Shipment information

• pickup address
• delivery address
• recipient information
• package characteristics
• tracking identifiers
• shipment instructions

Access Point information

• Dropo Customer ID
• Dropo receiving code
• package identifier
• selected Access Point
• arrival and release events
• QR/PIN credential status
• hold periods
• storage extensions
• return status

Location information

• pickup/drop-off coordinates
• driver GPS where applicable
• user-shared location
• approximate device location
• precise location when enabled

Transaction information

• charges
• invoices
• refunds
• credits
• payment status
• processor identifiers

Proof of delivery

• signatures
• photographs
• timestamps
• recipient information
• GPS evidence
• delivery notes

Partner information

• business details
• location information
• employee/staff roles
• package handling events
• payout information

Driver information

• identity
• contact information
• vehicle details
• insurance
• driving eligibility information
• screening/compliance information
• delivery activity
• earnings information

Device and technical information

• IP address
• browser/device type
• operating system
• cookies
• log information
• security events

User-provided content

• uploaded photos
• PDFs
• spreadsheets
• documents
• support messages
• Welly conversations
• attachments

8.3 Why Information Is Used

Information may be processed to:

• establish accounts;
• authenticate users;
• provide delivery services;
• provide package receiving services;
• provide tracking;
• calculate prices;
• process payments;
• provide customer support;
• prevent fraud;
• investigate incidents;
• improve safety;
• communicate service events;
• manage Access Points;
• manage drivers;
• comply with law;
• maintain audit records;
• secure Dropo;
• improve products.

8.4 Precise Geolocation

Precise geolocation must be treated as sensitive information.

Before collecting precise device location for optional user-facing functionality, show a contextual disclosure explaining:

• what location will be collected;
• why it is needed;
• whether it is shared;
• how long it is used/stored;
• how permission can be revoked.

Example:

Record:

8.5 Sharing

Dropo may share necessary information with:

• delivery persons;
• Access Point partners;
• carriers;
• recipients;
• payment processors;
• dispatch/routing providers;
• mapping/location providers;
• cloud/infrastructure providers;
• communication providers;
• security providers;
• professional advisers;
• government/law-enforcement authorities where lawfully required.

Only the minimum reasonably necessary information should be exposed to each role.

8.6 No Unnecessary Cross-Role Exposure

Partner staff must not receive unrelated customer data.

Drivers must not receive unrelated partner/business information.

Customers must not receive private driver records.

Business customers must not receive unrelated driver personal information.

Enforce through role-based authorization and RLS.

8.7 Data Retention

Retain personal information only as long as reasonably necessary for:

• service performance;
• legal requirements;
• disputes;
• claims;
• accounting;
• fraud prevention;
• security;
• compliance.

Where retention is legally required, records are kept even if deleted from view in the app.

Data no longer required should be deleted, deidentified or securely archived according to Dropo’s retention schedule.

8.8 Privacy Rights

Provide a privacy request mechanism allowing applicable users to request:

• access;
• correction;
• deletion;
• data portability;
• appeal where applicable;
• information about processing;
• opt-out where legally required.

Route:

Public route:

Provide identity verification before fulfilling sensitive requests.

8.9 Security

Dropo uses administrative, technical and organizational controls designed to protect information.

No system can guarantee absolute security.

Users must promptly report suspected account compromise.

8.10 Children

Dropo services are not directed to children under 13.

Dropo should not knowingly create independent accounts for children under 13 without an approved lawful process.

8.11 Policy Changes

Dropo will provide appropriate notice of material privacy changes.

Where renewed consent is legally required, Dropo will request it.